Hello everyone, next talk will be given by Jo Kina Madurka, and the name of the talk is APUP
100 line hack to make Wi-Fi great again.
Thank you for being here.
So APUP is what I've been working into the last year, in the context of a grant we received
from RDC, this radio amateur association of United States that granted ultramonded.
And we developed a few things to make a machine at work easier for people also to
mind time and deploy, and APUP is one of those pieces, let's get into it.
So in early 2000s, we had 50K, 56K connection, can you remember those?
If you don't remember, well, I unlock some memories.
So there was no broadband, no Wikipedia, no lunch, no market place at the time, and
not even worthy 54G, that little router that became a legend into hacker circles, because
you can change it's firmware and install Linux on top of it.
So it was a different word, but Wi-Fi, except for speed, and other things hasn't changed
that much.
So when people from the city returned to my small town, they were talking about EMEU,
and it was like a wonder for me, I was just a kid, and so I said, don't know, we must have
this ADSL in the small town, so I collected signature, and we managed to get the ISP
ADSL in my small town, but it was even more expensive that 50K connection.
So I thought what if we can share this connection between friends, and I recycled this
all-dealing router, if you notice 11B, I don't know if someone steals this round,
and then build some with yourself antennas, the photo is not mine, but what we did was
not that much different, do you remember the Pringles can with the Wi-Fi angle inside
more or less, and the things, and then I didn't even was capable to properly read English,
but being in a cross-forum, etc, I managed to set up the things, so I could connect to my
device to my own Wi-Fi from the other side of the town, but I discovered, sadly, that
I could not connect with other devices except with cable, because to connect to my home
Wi-Fi, I had to set up the router as a station, so it was not broadcasting a network
anymore, it was just a dumb client, and I asked why, isn't this thing a router, an access
point why is not broadcasting the network anymore, and so I started this journey studying
Wi-Fi routers, it was a young liter hacker with few resources, and basically, how Wi-Fi
works, we have CMA, every Wi-Fi device, when need to transmit something, it just, it's just
like humans, it's ear-reforced, it's okay, no one's talking, I can talk, and send the
Wi-Fi frame, otherwise if someone is talking, okay, let's just leap for a bit, around
them, enter one, and then I'll try again, so quite simple, but work enough good, and
what's inside those frames, we have the frame control, with a lot of bit fields, duration,
address one, which is source, others two, which is the Wi-Fi destination, it's the macadras
of the other Wi-Fi device, we suppose to receive that frame, then we have other three,
which is the actual destination, because beyond that Wi-Fi device, there may be an ethernet device
which is on macadras, which is not the one who transmitted or received directly the
frame, then when it's control and address four, address four as you see, it's
markets as optional, those bits, anyway, get transmitted, but they usually are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0es,
or they are polluting your spectrum to do nothing, they are there reserved for optional
uses, but almost no one uses them. So, could you spot a reason why access point cannot
talk each other in those Wi-Fi functioning? I didn't say why they cannot. There is
doesn't seem to be a solid reason to not do that. So, here's one buy. I keep bringing
this question up why a Wi-Fi access point cannot speak each other. Why is the actual solid
reason? I could not find it. I kept bringing this argument at Wi-Fi related conference
and so on. And no one had a convincing answer.
Many say, oh, you guessed the standard. You can do that, but yes, why? Why? Okay. And in the
meanwhile, while all those years, past buy many things come up. There was first this
repeat or extend a thing that was like a mix. So, an app, you had another access point,
but the access point behave also as a station. So, you have to configure it to connect
to the other access point and then create a virtual access point on top of that, which is
an actual, a pin put a nut in the middle. So, you can do it once at your house, but if you have to
do it with 10 devices, it's like, and also you have this nut in the middle, which is
untolerable. Then it come out wireless distribution system. The good thing about wireless distribution
system that we will see later again is the fact that you remember that for address that is
optional, wireless distribution system uses it, it's populated actually, and this make it
capable to finally bridge Ethernet connection to Wi-Fi connection seamless without going crazy.
But still, you are limited to a single access point and many, many, when a few stations that
connect, you can't even connect three devices in a row with VDA, with WDS.
Then, Adoc mode, IBSS, came, this was like, I'm many people, very, very
helpful about this, but there was no vendors, but so you get Wi-Fi card, you plug it, you hack with your
driver, but the firmware blob inside, the Wi-Fi card most likely doesn't support it.
Time to precise time synchronization, it's vital to Adoc to work, and this is quite problematic
in a distributed network, and even Linux implementation is terrible, and a maintenance here. Normal
normal devices may have a hard time, if you have an Adoc network, if you, they probably don't even
see it, if they see it, and you have to attempt to connect, they more, most probably crash.
Then 11S got released, it was like an Adoc mode, but more with more modern stuff, but as
cars vendor support, and they making it a bit bloat because they are coded, the routing protocol
between Wi-Fi devices into the standard, and so into the driver, so if a vendor want to
would like to support that, they have to put the routing protocol inside the driver, and another
bad thing about 11S is that bridging it to Adoc network, it was a mess, you have to set up
some node as proxy, you have limited number of proxy and so on, and again normal device doesn't
tend to not support it. Then we got Wi-Fi pre-to-peer, that was from Google, the name was
so-promising, whether so it is, oh, finally someone that doesn't think, but no, it was even greater
delusion, not really pre-to-peer, after discovery, the peer just decided, I'll be the access
point, I'll be the station, and that's it, and it's meant for a funeral, a flight transfer
into between Android devices, and no more. Then multi-AP come out, it's basically nothing new
under the sun, it's with WDS, a plus commercial branding, and over complication, the complication
is tackled down, relying on a central point of control, so if you're central control point
fail, your network say bye-bye, and it doesn't solve the thing again, and then, last one,
easy mesh, again, I'm a shop between multi-AP and repeater, even more complicated, not a real mesh,
not the mesh, we need it. So, 20 years has passed, and Wi-Fi alliance, with multi-billion dollar
budget, couldn't make a proper solution of the real problem, probably because they are not
interested into the real problem, they are more interested in selling you more devices.
So, what's the real reason I'm obsessed point in Wi-Fi, you cannot exchange that
a bit between each other, it's just because it's not written in the 1100A to 11 standard.
So, how can we implement yet? How can we implement a
access point access point communication? It looks something like that may be hard, but I think if we
have two access point, what if the access point one, when it receive a beacon from access point two,
be it like if that beacon was actually an association request from a station, and same goes
from a P2, when a P1 received an beacon. So, I investigated how I could do that,
what's actually deal with access point beacon is a step B, this is good, because a step D is also
a deal with the association request, so we can fix the thing all in one place. The code is pretty
convoluted, but studying it, I managed to to implement it unexpectedly, but it was possible.
So, there is the code, that's actually what I said it. Okay, I'm fake file.
Oh, now it's start the interesting part.
Okay, PPC. So, basically this function, a PUP process beacon, get an access point
beacon, and I'm going to start the struct, and it first of all, it can compare if the address
is over, so maybe we got a frame mirror, so in that case you know it, and then check if SSID is the same
of our SSID. This way, basically, it's executed only if the beacon received, that's the same SSID,
so the same network name. Then it extracts, basically, and get the Macadras, and put it into the
station list, which is a struct of the OSTAP demand time, where it keep all the station in OSTAP about.
It extracts a few fields, so this just add this a station, put this flag. So, basically,
we are pretending a station is associated with, but an access point will not do that by itself.
So, we are, do you see this flag? Bullan station outrised? We are setting that flag in the
station structure, so I'm saying, okay, this is an access point with my same SSID. Let's
read in as a, as a, as a, as a, as a, as a station.
In the, emit this event, basically, let's say, oh, I have outrised a new station, so all the other
part of the code, even the kernel, get notified about a new station getting outrised.
So, it sets that autorization mechanism is open, because encryption is not yet supported.
And then extract the capability, so the, the, the funny things is that you know, in a beacon,
you get almost everything you get in an association request, all the data, so the capability,
the bandwidth support, all everything, as a, an authorization request, contain, but in a different
order. So, you basically extract all those fields and sort them out,
fully most of the function to do that are already inside of that, because it does this kind of
things for other, for other stuff, then copy the, supported rates, copy the capability. This is
one of the little differences. So, if a station support 11 and rates, the association request,
we left this flag, WMM, set it, while in case of an access point, even it's support 11 and
rates, we will not have this flag set. So, we just check if there is 11 and capabilities,
we check, we set that flag manually. Copy order, capability is, copy 11, AC,
capabilities, copy, AC, capabilities, which is A, X, 11, A, X, capabilities, 11, B, E,
capabilities, and so on, then update some state, get the station ID, and finally set this flag.
Ah, the association request has been accepted successfully, and then set the
timeout to null function. This is an internal set of the functioning, basically it
will do every time a station send a packet, this pointer gets reset to null function.
So, it means for a bit of time, this station will not timeout, but if a bit more time passes,
at next iteration, the pointer will not be a self-null function, so we will timeout it.
It's like a pretty complex way to just put time to leave to a station,
relying on a function pointer. Okay, set the autorized flag, it's the associated flag,
and finally, add it as a proper station, autorized station with all these capability and so on.
You can see all those, all those flags and information we extracted, six years and blah blah,
at least at the year. We said, we call this function which again, set it as autorized,
set the flag, create a new interface, because it is using forever's mode, so we need to create
a new interface for just this, access point, peer connection, and set it as a VDS. Do you
remember, I said, when WDS, we will see this again, because to work this work, we need to use
for addressing mode that is just using that optional, reserved field, that for others,
that already in the standard Wi-Fi frame. And that's this set with WDS, STA, is what
make that actual. And that's it. This is the function that actually make an access point beacon,
BF, lag, and association requests, not much, not much code, but when where we get this,
this function called, OSTAPD have a loop that handle all the beacon that arrives from the kernel,
and just do a bit of things with those beacon, add them, add the property of the access point
to a list for Wi-Fi coexistence, and then call that function, and that's it, finish.
No, no, not finish the presentation, finish the code, but we are about to finish the presentation.
So it wasn't that difficult to make this work, and actually it's embedded and expected,
and pretty elegant too, if you see like, supporting a new, when a new Wi-Fi standard came out,
it's just adding a new line for supporting the new capabilities. Just a new line to copy the new
flags, not not difficult to maintain at all. But what about performance? One of the criticism
I got when I proposed this year. Yeah, you maybe you could do that, but performance would be shitty,
because if there is no the central access point that do coordination, you see, it will be,
well, so this is early testing with the very cheap devices. You can see like it's full speed,
in normal app station mode, it gets this fast, and a PUP gets this fast too,
is almost 200 megabit, the real TCP traffic, not just association, real TCP traffic,
and then after a few fixes, we got up to more than 200 megabits per second, the real TCP traffic.
So performance is not a problem. This is this as many advantages, although the previous solutions,
there is no need for driver support. The support in the driver is the same as a P, the driver
doesn't even know is running an a PUP network. It's just known is running a plane access point mode,
and AP mode is very well supported in most Wi-Fi drivers. Every serious Wi-Fi driver support
AP mode pretty well, because it's what everyone is using, and what works for AP mode,
works also for a PUP too, and this means that it's seamless hardware of loading. So basically,
a new Wi-Fi version to have this such great speed, many functionalities get off-loaded to the hardware,
are directly implemented into the hardware, but they just work with AP and Station mode,
not with 11S or other modes, and with a PUP, because it doesn't require any modification,
the driver is actually believing it's gave us a plane AP, it works too, can bridge seamless with
Ethernet like WDS, but you can also not do it, you can run a custom routing protocol in user space,
whatever you like on top of a PUP, it's agnostic, you don't need for extra virtual access point network,
and you name it. So, I know the problem, another crisis mode, but no one will accept this,
okay, open WRT already merged this, and on the WRT it didn't have a need to do a pull request,
they sell the patch online, and they included it, then I got notified by them because they find a
typo, and said, ah, we find this typo on your patch, please fix it, and I fix it it, so I know because
of that, I proposed it to OSTEPD mailing list, the only comment I got was about Tab and Space,
Intent, Intent, or most irrelevant, basically their policies, if it's not in the standard,
they try to not merge it, and so at this point, you can help too, we need, because interface is
represented, those IP are created dynamically, we need better support in it native the dynamic device
support in OpenWRT, also authentication and the encryption support not open, but the our
with restructured authentication setups need to be implemented, and then please engage with Wi-Fi
Alliance, so they consider to fix the standard once for all, and then merge it into OSTEPD.
If you're interested, there are further reading, I'll publish this presentation later, so you can
click the link, the notes, I took while implemented this, I implemented also a PUP support in
LibreMesh, which is this meta-firmware that you can use it to create frameworks that
once is started in the device, you can just put the device around and they self deploy,
without, without more trickery, free-funk use a PUP2, and they posted about it, I got interviewed by
Free-funk Radio, also there is another talk about the issue, which has been recorded, and
let's see, do you have some questions?
Hi, great, great stuff really, thank you, it happened with LTE also, but also with TLS protocol,
like it got written to be much simpler, do you think we're going to get 8 to 11?
Is that that to be like very simple thing, finally?
I'm not expert of LTE protocol, for what I studied of these things, in general, because
it's happened like Wi-Fi alliance, the big voices inside the alliance is not the actual developers
or hackers, it's big companies, which have other kind of interests, the interests is to
and also another kind of mindset, the mindset is, there must be a manager on top of me, the mega
hyper-special director will say you have to implement like this now, so there is always this
hierarchy in this kind of standards, but it's pretty arbitrary, I mean, I think there is no
arteries on why mobile-foying in these rooms could not use LTE network to communicate directly
between each other, and in fact, it could be even convenient in some situation, because
you need very, very much less power to send a frame from your mobile from there to a mobile
for another than sending the frame to a station to a base station that we don't know where it is
and then come back, so I mean, I think it's a mindset stuff, and you can see also when talking
to them, it's like they cannot even realize that's possible, but actually they made it possible,
because I'm not the mentor of CMCACA and the frame Wi-Fi frame structure, that was already existing.
So it seems like you are still relying on WDS in the driver to all drivers support that properly,
so we don't rely on WDS, but we rely just on on feeling that for others, I'd use the
OSTEPD function that's called the set-up VDS station, WDS station, but it's just to enable the
feeling of that for address field, which is already present in the frame, so the driver actually
do nothing, I didn't touch them, I didn't touch the kernel, just feed the feed with OSTEPD.
You talk about authentication and encryption that is still as to be implemented, do you think
there is going to come soon? Is it difficult or is going to create other problems?
Every piece you implement, you are going to encounter many things structured that way with that mindset,
that there is one which is the manager and another which is manager, but most of the things
really need the slight modification to work in another thing, so I don't think it will be
difficult to implement it, and most likely we could reuse, mostly reuse code that is already present
on OSTEPD. When the AP acting as the station, would that AP still work as an AP with its stations,
and how would that work when those two APs provide beacons on different channels?
Yeah, the station will the stations keep seeing it as a normal AP, they keep being treated as
normal stations, so for them it is completely seamless, this modification is just
basically the AP, the other AP gets treated almost like a station too, so for the station is the same,
if the access point are on different channels, well they will not see each other, but that's like
its basic station need to configure themselves in the same channel to connect to an exit point.
I have about four open WRTs in my house, as a practical thing if I just turn on this feature
will I be able to get the best closest AP and all, you know, that's what 8 or 2 we love and
ask for a supposed to fix, right, the machine is that that happens seamlessly with your patch.
This will happen seamlessly, the station, depending on their implementation, at some points
from an AP to another one, this is just part of the standard roaming between different
access points of the same SSID, so basically what this add is that what basically it's
obsolete 11S and all this stuff to make the access point talk each other, so if you can run a cable,
it's always better to run a cable, but if you cannot, or if your is in practical,
your access point will talk each other via Wi-Fi, I was curious whether we can get the RSSID signal
strength of your access point, connect PIGP and sorry, the this protocol from user space,
basically what happens it's all the other things, treat these things as they were normal
stations, so with the IW command, you see when you get do the as a damp the association list,
you will get also the other access point with the signal noise ratio and packet loss resolution
and so on. My question would be what happens if you have not to stay, two access points on
the same channel, but three or four and could it be that you create a loop and then the whole network
breaks down. Sure, you can create a loop. There was an in as light, the second test was made
in a network which was I don't know if 15 or 20 routers in sparse in a place, so many routers
each other, so basically a PUP, if you don't, don't disable the automatic bridging flag,
it will automatically create a bridge that works in simple technologies, but if there is loop,
you just disable the bridging flag and you run whatever route in protocol you want on top of it,
so it just provide to you for each access point inside, it provides a new internet interface,
so you can feed that interface to a routing protocol, for example, but when advanced,
if you want to have a layer to broadcast the main experience, or I mean bubble,
or whatever route in protocol you want to run on top of that, so if you have an network with loops,
you can run whatever route in protocol you want on top of it, just to go from, if I already have
a home network which is protected with WPA, I can't use this right now at least, you can
but the connection between access points will be unangripted, it wasn't something I did on
propose, but people that tested it reported it to me, what they noticed for some reason,
the performance was lower in the links between a P in this case, but I mean,
it's something that is not supposed to happen, but it's happen, and okay, it's not the bug,
not the feature, something we will work on when enable encryption and authentication,
probably what's going on, what I should post what's happening is that when encryption is enabled,
an apple, part of it is of loaded to the hardware, so if frames get transmitted without encryption,
get another path, without hardware of loading, so it's lower, but that's just an hypothesis,
I haven't investigated it yet,
thank you.